> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/edges/azure/az_intune_admin.md).

# AZ\_INTUNE\_ADMIN

## Summary

|                               |                                                                                                                                                    |
| ----------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Forestall ACL Alias**       | AZ\_INTUNE\_ADMIN                                                                                                                                  |
| **Entra ID (Azure AD) Alias** | Intune Administrator                                                                                                                               |
| **Affected Object Types**     | Tenant, Groups (and, when scoped to an Administrative Unit, the users/groups/devices in that unit)                                                 |
| **Exploitation Certainty**    | Certain                                                                                                                                            |
| **Graph Permission / Role**   | Membership in the built-in **Intune Administrator** directory role (`3a2c62db-5318-420d-8d74-23affee5d9d5`), direct or via a role-assignable group |

## Description

`AZ_INTUNE_ADMIN` represents the ability for a principal to operate as an **Intune Administrator** in Microsoft Entra ID. Intune Administrator is a **Tier 0** directory role because it controls device management and can be abused to run code on managed endpoints and to manipulate group membership.

The collector treats Intune Administrator as a privileged-role attack path and draws two kinds of edges from any principal that holds it:

* A tenant-level `AZ_INTUNE_ADMIN` edge to the tenant (for tenant-wide assignments).
* An `AZ_ADD_MEMBERS` edge, because Intune Administrator can add members to non-role-assignable groups (see [AZ\_ADD\_MEMBERS](https://docs.forestall.io/fsprotect/edges/azure/az_add_members)).

When the role is scoped to an **Administrative Unit**, the edges target the users, groups, and devices contained in that unit instead of the whole tenant.

The core abuse comes from device management: an Intune Administrator can push configuration profiles, PowerShell scripts, and applications to enrolled devices, executing code as **SYSTEM** on every managed endpoint the policy reaches.

## Identification

### PowerShell (Microsoft Graph)

```powershell
Connect-MgGraph -Scopes "RoleManagement.Read.Directory"

# List members of the Intune Administrator role
Get-MgRoleManagementDirectoryRoleAssignment `
  -Filter "roleDefinitionId eq '3a2c62db-5318-420d-8d74-23affee5d9d5'" `
  -ExpandProperty Principal |
  Select-Object PrincipalId, DirectoryScopeId,
    @{N='Type';E={$_.Principal.AdditionalProperties.'@odata.type'.Split('.')[-1]}},
    @{N='Name';E={$_.Principal.AdditionalProperties.displayName}}
```

### Azure Portal

1. Open **Microsoft Entra admin center** -> **Roles & administrators**.
2. Open **Intune Administrator** -> **Assignments**.
3. Record active and eligible (PIM) assignments; expand any assigned group to its transitive members.
4. Note the **Scope** column: **Directory** is tenant-wide, an object name is a scoped assignment.

## Exploitation

An Intune Administrator can manage devices and the policies applied to them. Common abuse patterns:

* **Code execution on managed devices** - deploy a PowerShell script or Win32 app through Intune to run as SYSTEM on enrolled endpoints, harvesting credentials or tokens.
* **Configuration tampering** - push device configuration or compliance profiles that weaken security posture.
* **Group membership** - add controlled principals to non-role-assignable groups that grant downstream access.

> **Related Attack Paths:**
>
> * [AZ\_ADD\_MEMBERS](https://docs.forestall.io/fsprotect/edges/azure/az_add_members) - the group-membership edge this role also produces.

## Mitigation

* Keep **Intune Administrator** assignments minimal and prefer eligible (PIM) assignments with MFA and approval.
* Restrict who can author and assign device configuration and scripts.
* Scope the role to Administrative Units where tenant-wide device control is not required.
* Review role membership and Intune script/app deployments regularly.

## Detection

Use the Microsoft Entra admin center and Intune:

1. Open **Microsoft Entra ID** -> **Audit logs** and filter **Activity** for role assignment changes targeting Intune Administrator.
2. In the **Microsoft Intune admin center**, review **Audit logs** for new device configuration profiles, scripts, and app deployments.
3. Review **Initiated by (actor)**, **Target**, **Date**, and **Status** for unexpected changes.
4. Open **Roles & administrators** -> **Intune Administrator** -> **Assignments** to confirm current assignments and recent activations.

## References

* <https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#intune-administrator>
* <https://learn.microsoft.com/en-us/mem/intune/fundamentals/role-based-access-control>
* <https://specterops.github.io/TierZeroTable/>
* <https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-audit-logs>